Temporary Login Without Password

Temporary Login Without Password is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 1.9.9.

Temporary Login Without Password from 1.5 through versions before 1.9.9 fails to require network-super-admin authority before granting those rights to a temporary or existing account. A single-site administrator on WordPress multisite can promote their own account or another account and take over the network. The authoritative export does not name the handler or privilege field.

Temporary Login Without Password is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.